CVE-2020-10390 Command injection in n/a
Remote attackers can execute arbitrary code by injecting commands into the wkhtmltopdf path setting in Chadha PHPKB.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10390?
CVE-2020-10390 is a high-severity command injection vulnerability in Chadhaajay Phpkb, published on 12 Mar 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OS Command Injection in export.php (vulnerable function called from include/functions-article.php) in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php.
Weakness: CWE-78
Which versions are affected by CVE-2020-10390?
It affects 1 product.
Products include Chadhaajay Phpkb.
How do I fix CVE-2020-10390?
No fix has been published for CVE-2020-10390 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-10390 being exploited?
There is no known exploitation of CVE-2020-10390 in the wild and no public exploit code.
Other vulnerabilities in Chadhaajay Phpkb
Sources
Also known as GHSA-98v9-rg9c-r4gg.